Dear Sirs,
I am using lookup to enrich my event data on the fly, and it seems to work fine. However, every invocation of the function lookup produces a warning to the splunkd.log as follows:
06-04-2020 18:39:27.136 +0300 WARN CsvDataProvider - Unable to find filename property for lookup=splunk-installation-info.csv will attempt to use implicit filename.
The search producing the above is
| rest splunk_server=lic /services/licenser/slaves
| lookup splunk-installation-info.csv splunk_uuid AS title OUTPUT BU
It works, but I am puzzled by the warning. I would like to get rid of it, so how do I tell Splunk the explicit filename?
Best regards,
Petri
I got into the same error...Has there any solution for this issue....
Can you check what is the character-encoding of that file, directly in the cli with command file -i lookup_name.csv?
In my situation, the encoding type was different from "text/plain; charset=us-ascii", was in fact "application/octet-stream; charset=binary".
I opened the file in Notepad++, changed encoding to UTF8, loaded the file again to splunk with lookup editor, and it worked.
Let me know if this works for you also.